GLPI privilege escalation via user cloning
A regular technician can create an administrator account in this IT tool.
Summary
A logged-in user with the Technician profile can clone a Super-Admin account in the GLPI IT management software and create an account they control. Versions 10.0.0 to before 10.0.28 and 11.0.0 to before 11.0.10 are affected.
Affected when
- Logged-in account with the Technician profile
- GLPI 10.0.0 to before 10.0.28 or 11.0.0 to before 11.0.10
What to do
Update to 10.0.28 (10.0 line) or 11.0.10 (11.0 line) or later.
Update to at least the version for your product:
- GLPI 10.0 10.0.28 or later
- GLPI 11.0 11.0.10 or later
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab)
- Write-up: vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen